From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 14132 invoked by alias); 20 Oct 2008 22:09:32 -0000 Received: (qmail 14120 invoked by uid 22791); 20 Oct 2008 22:09:30 -0000 X-Spam-Check-By: sourceware.org Received: from n2.bullet.mail.gq1.yahoo.com (HELO n2.bullet.mail.gq1.yahoo.com) (67.195.9.85) by sourceware.org (qpsmtpd/0.31) with SMTP; Mon, 20 Oct 2008 22:08:46 +0000 Received: from [67.195.9.81] by n2.bullet.mail.gq1.yahoo.com with NNFMP; 20 Oct 2008 22:08:44 -0000 Received: from [67.195.9.109] by t1.bullet.mail.gq1.yahoo.com with NNFMP; 20 Oct 2008 22:08:44 -0000 Received: from [127.0.0.1] by omp113.mail.gq1.yahoo.com with NNFMP; 20 Oct 2008 22:08:44 -0000 X-Yahoo-Newman-Property: ymail-3 X-Yahoo-Newman-Id: 499403.68510.bm@omp113.mail.gq1.yahoo.com Received: (qmail 30425 invoked by uid 60001); 20 Oct 2008 22:08:44 -0000 X-YMail-OSG: B4iG_rEVM1nTpysfCuKkO3u9m.D2IO_MoRKNYrRj9bzGyxnJGmU- Received: from [38.106.153.14] by web110007.mail.gq1.yahoo.com via HTTP; Mon, 20 Oct 2008 15:08:44 PDT X-Mailer: YahooMailRC/1155.11 YahooMailWebService/0.7.247.3 Date: Mon, 20 Oct 2008 22:09:00 -0000 From: Jary Grove Subject: Re: JESSIE - SSL BAD_CERTIFICATE Exception To: Casey Marshall Cc: java@gcc.gnu.org MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Message-ID: <266224.30114.qm@web110007.mail.gq1.yahoo.com> X-IsSubscribed: yes Mailing-List: contact java-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: java-owner@gcc.gnu.org X-SW-Source: 2008-10/txt/msg00020.txt.bz2 Any quick fix?=20 I am compiling Jessie from the source and will be able to plug in the chang= es easily, if you can give me some pointers on how to ignore this error.=20 Thanks Jary ----- Original Message ---- > From: Casey Marshall > To: Jary Grove > Cc: java@gcc.gnu.org > Sent: Monday, October 20, 2008 3:02:20 PM > Subject: Re: JESSIE - SSL BAD_CERTIFICATE Exception >=20 > On Sat, Oct 18, 2008 at 2:17 PM, Jary Grove wrote: > > I am getting the BAD CERTIFICATE exception with jessie, any idea? I am = using=20 > the latest build. > > > > Following is the exception log: > > > > > > SSL HANDSHAKE output to {0}; state:{1}; outBuffer:{2}=20 > java.nio.ByteBufferImpl[pos=3D5 lim=3D18432 cap=3D18 > > 432] WRITE_CLIENT_HELLO null > > SSL HANDSHAKE loop state=3D{0} WRITE_CLIENT_HELLO > > SSL HANDSHAKE {0} struct { > >=A0 version: TLSv1.1; > >=A0 random: > >=A0 struct { > >=A0 =A0 gmt_unix_time: 1224363825; > >=A0 =A0 random_bytes:=A0=20 > 9a:15:99:6d:25:e3:04:7c:ff:3a:12:e1:ff:19:b1:f6:61:07:a3:2e:57:cc:aa:db:d= d:47:82: > > f5; > >=A0 } Random;=A0 sessionId: ; > >=A0 cipher_suites: > >=A0 [30] { > >=A0 =A0 TLS_DHE_DSS_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DHE_DSS_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_RC4_128_MD5, > >=A0 =A0 TLS_RSA_WITH_RC4_128_SHA, > >=A0 =A0 TLS_DHE_DSS_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_RSA_EXPORT_WITH_RC4_40_MD5, > >=A0 =A0 TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_NULL_MD5, > >=A0 =A0 TLS_RSA_WITH_NULL_SHA > >=A0 }; > >=A0 compression_methods: > >=A0 [1] { > >=A0 =A0 NULL > >=A0 }; > >=A0 extensions:=A0 =A0 ExtensionList { > >=A0 =A0 =A0 length =3D 2; > >=A0 =A0 }; > > } ClientHello; > > SSL HANDSHAKE processing in state {0}: > > {1} READ_SERVER_HELLO struct { > >=A0 type: SERVER_HELLO; > >=A0 struct { > >=A0 =A0 version: TLSv1; > >=A0 =A0 random: > >=A0 =A0 struct { > >=A0 =A0 =A0 gmt_unix_time: 1224363827; > >=A0 =A0 =A0 random_bytes:=A0=20 > 9a:a2:ee:0f:d6:e5:22:22:8d:66:f0:f6:57:c1:a6:60:7e:a1:01:25:df:7e:05:2e:0= 8:1c:c > > 6:de; > >=A0 =A0 } Random; > >=A0 =A0 sessionId:=A0 =A0 =A0 =A0=20 > e1:07:00:00:36:0f:05:21:64:d7:f4:e2:7c:7d:6d:b4:6c:50:7a:9d:26:99:03:e0:b= c:23 > > :f9:db:df:09:61:8a; > >=A0 =A0 cipherSuite:=A0 =A0 =A0 TLS_RSA_WITH_RC4_128_MD5; > >=A0 =A0 compressionMethod: NULL; > >=A0 =A0 extensions: > >=A0 =A0 =A0 (nil) > >=A0 } ServerHello; > > } Handshake; > > SSL HANDSHAKE processing in state {0}: > > {1} READ_CERTIFICATE struct { > >=A0 type: CERTIFICATE; > >=A0 struct { > >=A0 =A0 java.security.cert.CertificateException: malformed GeneralName: = Tag class=20 > is 0; > > } Certificate; > > } Handshake; >=20 > This part looks relevant. It's possible that the X.509 parser in > classpath/gcj isn't able to properly parse your certificate. In this > case, it's failing to parse the GeneralName extension. >=20 > I don't remember the details of ASN.1, DER, and this certificate > extension, but it's possible this extension blob in your certificate > isn't correct. >=20 > One thing that may help this is to change the certificate parser to > just ignore extensions that it can't parse, leaving them as blobs of > bytes, unless someone wants to use that extension. X.509 and interop > is a bag of pain; adding hacks and special cases to handle > not-quite-correct certificates is something everyone ends up doing. >=20 > Anyway, I'll call this a bug in our certificate parser. >=20 > Thanks. >=20 > > gnu.javax.net.ssl.provider.AlertException: BAD_CERTIFICATE: locally gen= erated;=20 > FATAL > > SSL HANDSHAKE output to {0}; state:{1}; outBuffer:{2}=20 > java.nio.ByteBufferImpl[pos=3D5 lim=3D18432 cap=3D18 > > 432] WRITE_CLIENT_HELLO null > > SSL HANDSHAKE loop state=3D{0} WRITE_CLIENT_HELLO > > SSL HANDSHAKE {0} struct { > >=A0 version: TLSv1.1; > >=A0 random: > >=A0 struct { > >=A0 =A0 gmt_unix_time: 1224363826; > >=A0 =A0 random_bytes:=A0=20 > 84:d5:62:3a:00:a9:d5:c9:3c:fe:13:05:6d:04:10:9e:0e:5b:ae:b7:72:37:b4:ef:f= 8:56:7d: > > 79; > >=A0 } Random;=A0 sessionId: ; > >=A0 cipher_suites: > >=A0 [30] { > >=A0 =A0 TLS_DHE_DSS_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_AES_256_CBC_SHA, > >=A0 =A0 TLS_DHE_DSS_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_AES_128_CBC_SHA, > >=A0 =A0 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_3DES_EDE_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_RC4_128_MD5, > >=A0 =A0 TLS_RSA_WITH_RC4_128_SHA, > >=A0 =A0 TLS_DHE_DSS_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_DES_CBC_SHA, > >=A0 =A0 TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_RSA_EXPORT_WITH_RC4_40_MD5, > >=A0 =A0 TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, > >=A0 =A0 TLS_RSA_WITH_NULL_MD5, > >=A0 =A0 TLS_RSA_WITH_NULL_SHA > >=A0 }; > >=A0 compression_methods: > >=A0 [1] { > >=A0 =A0 NULL > >=A0 }; > >=A0 extensions:=A0 =A0 ExtensionList { > >=A0 =A0 =A0 length =3D 2; > >=A0 =A0 }; > > } ClientHello; > > SSL HANDSHAKE processing in state {0}: > > {1} READ_SERVER_HELLO struct { > >=A0 type: SERVER_HELLO; > >=A0 struct { > >=A0 =A0 version: TLSv1; > >=A0 =A0 random: > >=A0 =A0 struct { > >=A0 =A0 =A0 gmt_unix_time: 1224363827; > >=A0 =A0 =A0 random_bytes:=A0=20 > 36:f4:51:d4:92:23:79:ac:41:86:d2:ec:29:c8:3b:e8:58:78:72:4e:42:48:0b:27:9= 7:df:5 > > 9:b0; > >=A0 =A0 } Random; > >=A0 =A0 sessionId:=A0 =A0 =A0 =A0=20 > d8:03:00:00:cf:90:b3:93:8c:9d:e6:ca:b1:7a:f1:cf:6f:4f:1f:20:ab:86:c8:d9:f= f:61 > > :c4:a4:2d:68:b4:0d; > >=A0 =A0 cipherSuite:=A0 =A0 =A0 TLS_RSA_WITH_RC4_128_MD5; > >=A0 =A0 compressionMethod: NULL; > >=A0 =A0 extensions: > >=A0 =A0 =A0 (nil) > >=A0 } ServerHello; > > } Handshake; > > SSL HANDSHAKE processing in state {0}: > > {1} READ_CERTIFICATE struct { > >=A0 type: CERTIFICATE; > >=A0 struct { > >=A0 =A0 java.security.cert.CertificateException: malformed GeneralName: = Tag class=20 > is 0; > > } Certificate; > > } Handshake; > > > > > > > > Thanks > > Jary > > > > > > __________________________________________________ > > Do You Yahoo!? > > Tired of spam?=A0 Yahoo! Mail has the best spam protection around > > http://mail.yahoo..com > > > > __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around=20 http://mail.yahoo.com